Skip to content

Commit

Permalink
[Alerts] Fix Elasticsearch query rule with KQL evaluation matched doc…
Browse files Browse the repository at this point in the history
… count (#176620)

- Closes #176453

## Summary

This PR adds `track_total_hits` to the ES request. Otherwise it's
limited to 10000.

Tested with index connector:
<img width="500" alt="Screenshot 2024-02-09 at 18 05 51"
src="https://github.com/elastic/kibana/assets/1415710/643e504c-91c6-47ae-b2b9-45b132ca5755">


### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
  • Loading branch information
jughosta authored Feb 14, 2024
1 parent 134d677 commit e2dfb09
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,7 @@ describe('fetchSearchSourceQuery', () => {
dateEnd
);
const searchRequest = searchSource.getSearchRequestBody();
expect(searchRequest.track_total_hits).toBe(true);
expect(filterToExcludeHitsFromPreviousRun).toMatchInlineSnapshot(`
Object {
"meta": Object {
Expand Down Expand Up @@ -282,6 +283,7 @@ describe('fetchSearchSourceQuery', () => {
dateEnd
);
const searchRequest = searchSource.getSearchRequestBody();
expect(searchRequest.track_total_hits).toBeUndefined();
expect(searchRequest.size).toMatchInlineSnapshot(`0`);
expect(searchRequest.query).toMatchInlineSnapshot(`
Object {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,9 @@ export function updateSearchSource(
}

const searchSourceChild = searchSource.createChild();
if (!isGroupAgg) {
searchSourceChild.setField('trackTotalHits', true);
}
searchSourceChild.setField('filter', filters as Filter[]);
searchSourceChild.setField('sort', [
{
Expand Down

0 comments on commit e2dfb09

Please sign in to comment.